There is also another reason why you need to have at least two tokens: If I understand correctly, if you need to change the CTL file after it is created, then you need to have at least one of the tokens that was originally used. Changing the CTL file could be needed if you add an additional subscriber, or if you add an ASA proxy. Therefore, two tokens is for safety: Keep one token in a safe place, and keep the other token in another safe place somewhere else.
... View more
